oh, it appears my intermediate CA cert is only 5 years, whereas my root CA was 10 years. using a 1 year expiration got me past this